Warning: WHY2025 Badge is a fire hazard

Juerd · August 5, 2025, 8:49pm

This document was originally posted in two places:

WHY2025 badge fire hazard advisory

The WHY2025 badge is a fire hazard when used with unprotected cells. Unprotected cells themselves are intrinsically unsafe and require additional safety measures which are not provided by the badge. In fact, the badge makes it worse.

Background information

Visitors of WHY2025 can get a badge, a fun electronic gadget that is a true work of art. These badges have become a tradition at this kind of conference/festival.

Designing a badge is a large effort, and in this edition it was done in just a few months. Unfortunately, with this edition’s design and intended use, the only thing preventing a fire is, basically, a thin layer of paint (actually resin (solder mask)).

The WHY2025 badge was designed to be powered by 2 Li-Ion 18650 battery cells connected in parallel. The cells provided to visitors are of the “unprotected” kind and thus capable of providing a very large short circuit current. A short circuit can cause parts to overheat, posing a burn or fire risk to nearby materials (e.g. skin, clothing, luggage). Due to the design of the badge, there are several ways a short circuit could occur.

Image from Tweakers

TL;DR

Never have the 18650 cells installed in the WHY2025 badge; return the 18650 cells to the Badge tent or keep the 18650 cells themselves in a sturdy non-conductive enclosure if you want to keep them for different purposes (e.g. in a safe powerbank).

It may be safe to use the badge with an external USB power supply instead, as those will typically provide the necessary protections.

Nomenclature: “batteries” vs “cells”

In the remainder of this document, a distinction is made between these terms, following the definitions in EN 61960, a European standard titled “Secondary cells and batteries containing alkaline or other non-acid electrolytes - Secondary lithium cells and batteries for portable applications” (based on IEC 61960).

A cell is a building block for creating a battery.

A cell derives electrical energy derived from a chemical reaction. Notably, according to EN 61960, “It is not ready for use in an application because it is not yet fitted with its final housing, terminal arrangement and electronic control device”.

A battery consists of one or more cells, an “adequate housing”, and if necessary, control electronics. Common examples of batteries include powerbanks and powertool batteries. Batteries are also found in laptops and phones, and those are usually integrated in the same housing.

The 18650 Li-Ion cells

Li-Ion battery technology comes with inherent risks. These risks can be mitigated to the point that they can be used safely in consumer products, but the WHY2025 badge does not come with sufficient protection.

The cells themselves are dangerous when not handled carefully. Almost the entire metal surface of the cell is the negative or “-” side, with a small portion on top that is the positive or “+” side. The outer ring on the “+” end of the cell is connected to the “-” too, and there is an insulating ring between those.

When the “+” of the cell is connected with the “-” side with a negligible resistance (i.e. short circuit), it is said that it could explode if that condition lasts long enough. We have not tested this with the WHY2025 badge cells, but there are videos of similar cells doing exactly that, and some that didn’t. The ones that don’t explode still do get very hot.

Image from Wikipedia

A thin layer of a sturdy plastic foil keeps most of the negative contact surface covered. This provides electrical insulation but it can be damaged by sharp objects, or sometimes even during insertion into cell holders. If the “+” and “-” side are then connected by means of a conductive material, a short circuit occurs which leads to very high temperatures, capable of igniting common materials.

There exist protected cells that have a protective circuit at the end of the cell, wrapped together with the cell in one protective foil. These are popular for use with flashlights. When used in an enclosure, those are very safe against short circuits: the protective circuit protects against external short circuits, while the enclosure and sufficient insulation/clearance within the sleeve protect against internal short circuits in the “battery” (protected cell).

With a protected cell without housing, something could still cut through the foil and separate the protective circuit, but this does not happen easily. With careful use, they can be somewhat safe to use without an enclosure. A similar design (but with flat “pouch” style cells instead of cylindrical) was used in the SHA2017 and MCH2022 badges.

The WHY2025 badge cells do not have a built-in protection circuit. Commonly available protected 18650 cells don’t fit in the badge’s cell holders because they are slightly longer.

The badge, being a badge, does not have an enclosure and as such doesn’t provide the “adequate housing” that is necessary for a battery. The cells are handed out without a carrying case, so unless you know what you’re doing, you can’t even transport them safely.

The badge itself: short circuit risk

The problems exist in the “Carrier” PCB of the badge. This is the large circuit board to which the two cell holders are soldered. There are several design issues that increase the risk of a short circuit.

The design of the power source of the badge resembles that of a powerbank. In fact, it actually uses a powerbank IC (chip) at the heart. Instead of providing power to external devices, it provides power to the rest of the badge, but apart from that, it is a basically just a powerbank.

Unlike powerbanks, the badges don’t have housings to protect them from mechanical damage. That’s what makes the badge a badge, of course, but the combination of unprotected cells, lack of a housing, and unfortunate PCB design oversights make a recipe for disaster.

Copper layer and solder mask

On the outer copper layer of the PCB, there are a GND plane and the “+” and “-” traces that are directly connected to the cells. The GND plane is connected, indirectly, to the “-” of the cell.

These copper areas are 0,4 mm apart.

Any inadvertent electrical connection between “+” and either GND or “-” constitutes a dangerous short circuit. This could by caused by something made from metal. The hazard is still present when the badge is switched off.

A component can eventually burn up and as such, open the circuit. In that sense, the problem may be self-limiting, but this may or may not happen fast enough to prevent reaching a temperature that is dangerously high. In a test setup with a WHY2025 badge and a 20 A external power supply (the cells can provide more than that!), it took too long, and the MOSFET became yellow glowing hot. That indicates a temperature of 2000 °C.

There is a protective circuit. There are polyfuses and there are the protections offered by the powerbank IC. Whether the chosen components are right for their purpose, was not assessed by us. Assuming these controls work as intended, everything behind them can be considered protected against short circuits.

The circuitry that connects the cells to the protections, on the other hand, can only be protected against short circuits mechanically, but there is no proper mechanical protection: the only mechanical protection present is the solder mask.

One cell’s unprotected “+” trace goes horizontally across the width of the board before it finally reaches its polyfuse. It is somewhat mechanically protected by ~~the loudspeaker connector and~~ (edit: the connector is not present in the final badges) the “compute module” (the M2 daughter board). The solder joints of the loudspeaker connector are, again, very close to both the GND plane and the cell “+” trace.

The solder mask is a very thin layer of resin (probably 10 to 30 µm (MICROmeter)) on top of the copper traces and planes. It is the outermost layer of the circuit board, and surrounds the components.

Solder mask is electrically insulating but easily damaged, and as such is insufficient as the only mechanical barrier if short circuits must be prevented.

The cell holder tabs

The cell holders have “tabs” that extend on both ends, that are soldered onto “pads” on the circuit board. These combined are part of the “footprint” of the part.

The footprint for the cell holders was designed for a different cell holder, but at some point another model was chosen. The footprint was kept as the new cell holder appeared to fit.

However, the pads for the cell holders are too small for the tabs. Due to tolerances in the manufacturing process, as specified in the manufacturer’s datasheet, there will be differences between individual badges. It is possible that in some badges, the tab will overlap with the GND plane or at least be very very close to it. The distance between the “+” pad and GND is designed at only 0,4 mm, and the sum of the tolerances is more than that. When the tab and the GND plane overlap, they are separated only by solder mask.

Exposed (uninsulated) solder joints (mitigated)

There is a GND solder joint very close (~ 0,6 mm) to the “+” pad of one of the cell holders. That was the first danger we saw. There are, however, also numerous other “+” and “GND” solder joints.

With these open solder joints, touching the badge to any shaped conductive material (e.g. jewelry or metal zippers) can cause a short circuit. If that short circuit occurs on the unsafe side of the protection circuitry, it can lead to a fire.

An attempt is going to be made to mitigate this specific risk by applying a layer of epoxy resin on top of the open solder joints. This should reduce the chance that something goes wrong, but since it does not address the other issues, we find it insufficient.

Exposed cell and cell holder contacts

Similar to the previous issue, even with the cells inserted into their holders, there remain parts of the “+” and “-” sides, that are uncovered.

Using the badge and having fun!

When powered from USB, the badge is probably safe to use (no guarantees though), at least within the realm of not catching fire. USB power sources should always provide short circuit protection for the cables and devices connected (but do buy only from trustworthy sellers).

Many short circuit protections in things like powerbanks and USB chargers are self-resetting, but some will sacrifice future functionality for the sake of immediate safety. At least it should be very unlikely to allow sufficient current to cause something to get glowing hot. (We did not test this.)

Comparison with earlier badges

The badges for MCH2022 and SHA2017 also did not have an adequate housing for the cells. They did, however, come with protected cells. The protection part of those cells had larger clearance distances, and two layers of yellow kapton tape (estimated at 120 µm thickness) for insulation, which is much more than the ~30 µm that you might get from a solder mask.

Danger is not boolean. The WHY2025 badge is more dangerous than the previous ones. Accepting the risk for previous badges should not imply accepting the risk for new ones, especially not a larger risk.

Image from Hackaday

Lessons for future badges

Some design patterns that would be merely sketchy or even completely fine in a properly enclosed product, can easily become dangerous when people wear and store a bare PCB. The bare PCB of a badge is more likely to get damaged than the PCB in a proper enclosure. Regular products typically come with a warning to stop using them if the case is showing signs of damage, but a badge typically doesn’t even come with a case. Solder mask can only be relied on to prevent short circuit protection against adjacent traces, if the solder mask itself is protected against mechanical damage.

There should be a proper review process and a high priority for keeping people safe.

(Co-)signatories

Juerd

The following people have proof read the contents of this article and wanted to express that they agree:

CH23
f0x
CensoredUsername
Peetz0r
illyau
fk
krekr
pbx
lmpsk

(Originally, I didn’t intend on having co-signatories, and in the interest of timely release, I didn’t ask all the experts, who advised on the matter, to sign.)

Personal note

I have nothing personal against the designers of the badge or the IFCAT board members. Communication and cooperation with IFCAT on the topic of disclosure has been friendly and professional. However, I still do think they’re making the wrong decision, to push forward with an unsafe badge and unprotected cells.

A public document like this may seem drastic. Going public was the last resort to reduce the risk of a fire breaking out. I’m concerned with fire in tents or luggage, and it keeps me up at night.

I’m also gut wrenched that this issue will now be a further burden to all parties involved, including the buildup crew and PL who are already very occupied with organizing the event itself. But I promised to do this and I think it’s really important.

Let’s have a great and fun camp, with fires only in the designated spots.

Timeline

Everything happened during the past few weeks, while I was also busy helping out with the heap of work for Team:Warehouse. Most of the time was spent trying to gather expert opinions and educating myself (I’m an utter newbie in electronics), and trying to convince the organization to change course (i.e. to not provide unprotected cells and to inform visitors that they shouldn’t use their own cells either). Everyone I asked agreed that there is a fire hazard, although not everyone ranks the individual risks the same. The back and forth between people takes a lot of time, and I just didn’t have the time to write an article earlier. Some have asked me to publish earlier, but I wanted to coordinate this with the foundation board first. By the time this document is published, they probably also have a statement ready.

2025-07-17 First problems identified in final prototype, destructive test conducted at hackerspace, IFCAT notified informally via Signal.
2025-07-17-20 More experts contacted for advice.
2025-07-20 Team:Badge had a meeting (contents unknown) and apparently decided to mitigate the solder joints, but not the rest.
2025-07-20 IFCAT notified formally by phone.
2025-07-25 Repeated plea (IRL) to IFCAT board member to not use the unprotected cells.
2025-07-28 Repeated plea (IRC) to different IFCAT board member to not use the unprotected cells.
2025-08-03 (during buildup) Public advisory written
2025-08-04 (during buildup) Meeting with IFCAT board members and someone from Team:Cohesion; final plea to change course; disclosure coordination
2025-08-05 (during buildup) Advisory published

illyau · August 5, 2025, 9:38pm

Thank you for making this public and disclosing these issues! And thank you for the hard work you have put into this in the last weeks and during buildup! It’s sad this had to come this far.

Juerd · August 5, 2025, 9:43pm

Response from IFCAT: What Hackers Yearn 2025

My response to specific parts:

The protection circuitry is on the carrier-board PCB adjacent to the cells. The short interconnects pass close to ground planes/components.

The interconnect is not short. One cell is on the left, when the the protection circuit is on the right. The thick trace goes across the board before it finally reaches its fuse. It is flanked by the GND plane on both sides, at 0.4 mm distance.

Because production had already started, the use of unprotected 18650 cells and the carrier-board layout, incl. the unprotected path from the cells to the protection circuitry on the PCB, could not be changed.

“Could not be changed”?! Of course you can change course. Just don’t use the cell holders and don’t hand out unprotected cells to lay people. Those measures don’t require any change to the badge itself.

Several options were discussed in the past few weeks, when there was still plenty of time. One option was to glue wooden 18 mm dowels in the cell holders. Another was to put a sticker over the cell holders. The badge can be powered using an external power bank, which should be much safer because those should come with the short circuit protection that part of the badge lacks.

It is still possible to just not supply the cells, and to warn people that they shouldn’t use the cell holders. There is also still time to ask visitors to bring their own power banks.

Doing the right thing has been possible, and is still possible. Pushing forward is a choice, and has literally nothing to do with the badge already being or having been produced.

The mitigations listed below were evaluated and adopted, and were communicated to the reporter prior to publication.
To reduce risk, the exposed battery contacts and the surrounding area will be covered with UV-curing epoxy.

It mitigates the largest risk, but not everything.

In my estimation, this moves the risk level from “will go wrong” to “might go right”. That’s still quite a large risk to take with visitor’s lives.

Furthermore, do not charge a badge unattended in a tent,

That’s a good idea, but unrelated to the specific issues.

The risk of a short circuit is still present when the badge is off and not charging.

and don’t throw it carelessly into your bag.

And don’t wear it on metal clothing, don’t put it in a bag that also has metal things in it, etc, etc.

For those who prefer to avoid the risks, powering the badge from a power bank is fully supported.

Also, maybe don’t pitch your tent next to people who think it’s safe enough. Fires have a nasty habit of expanding beyond the direct vicinity of the person who took the risk.

The functionality of the badge and the performance remain unaffected when powered externally.

Exactly! So why are we taking this risk at all then?

renze · August 5, 2025, 11:05pm

During the development process of the WHY2025 badge we (Badge.Team) warned multiple times against the use of unprotected lithium cells because of the associated risks. We held our stance, until the separation from the WHY2025 project, that only protected cells must be used, in a way in which users can not accidentally cause harm to themselves and others (the lithium pouch cells Badge.Team has used thus far provide such certainties).
Our advice was willfully ignored.
Now that we are at the point where unfortunately the risk has been identified and published about I would like to point out the following:

Willfully handing out devices which can under (for the user) normal circumstances pose a fire hazard can cause irreparable harm, not just to the event but also to the concept of non-compliance tested hardware being handed out at hacker events.

No-one in our community would of course sue IFCAT for damages if something were to happen. The same is not the case for external parties. Imagine for a second that someone ignores the now published safety warning and uses his badge (potentially unknowingly) in a way which does cause a fire. Imagine that damage occurs to goods and/or people. Now a situation occurs where an insurance company will try to hold someone accountable.
In the first place this will cause a long term financial risk to IFCAT as damage can and probably will occur even after the camp. In addition the news coverage of a non-compliant device causing harm can potentially cause irreparable harm to our community, for example by government intervention.

tl;dr: I strongly advise to either fix all problems before handing out the badges or if it is deemed impossible to not hand out the badges at all.

@juerd: feel free to add my name to the signatures list.

eloy · August 6, 2025, 12:27am

Assuming the 18650s are not used, the safety hinges on the quality of the power bank that people bring themselves. Would it be feasible to set up some testing station where people can test the safety of their own power bank?

Peetz0r · August 6, 2025, 1:05am

It’s really hard to test those things

safely
non-destructively
without expensive test equipment

However, if you bought it within the EU at any even remotely reputable place, it’ll have to meet a bunch of requirements (some of which noted in the long texts above) so it’ll at least be a lot safer than bare unprotected 18650’s.

Yes, a shitty powerbank can be dangerous as well. But the vast majority of powerbanks are fine, and even if not, we’re not handing out thousands of them.

CensoredUsername · August 6, 2025, 1:07am

My questions on the response are as follows:

To reduce risk, the exposed battery contacts and the surrounding area will be covered with UV-curing epoxy. This application will take place on-site in the badge sweatshop in the days leading up to the event.

That sounds good, but a significant part of the exposed area is the spring that wraps around the top of the holder to where it touches the battery. This is the easiest part to short circuit as just a long metal object can do the trick here. Will the top of the holder be covered as well? or is it just the sides and the tabs.

IFCAT initiated a review with external experts in lithium cells and development-kit design. The review concluded that risk mitigations were required.

Glad to see our conclusions were corroborated at least. Were the listed risk mitigations suggested / approved by these external experts as well?

The badge is considered a development kit. Therefore, avoid bending, crushing, or piercing the battery area. Furthermore, do not charge a badge unattended in a tent, and don’t throw it carelessly into your bag. Exposed 18650 Li-ion cells pose risks, and devkits are inherently fragile and require careful handling.

This is all good advice, but I dislike the devkit analogy here. You treat devkits carefully because they could easily be broken. But in this case the issue isn’t the devkit breaking, it’s that the devkit poses danger to other things. That is not a normal situation, even for devkits.

Badges will only be handed out to children aged 7 and up.

What is the reasoning for this cutoff? 7 years is a good cutoff for basic things because kids probably stopped trying to eat random things or stick them up their nose. The problems here are a bit more subtle, and just because a kid is 7 normally doesn’t mean we trust them to understand and follow warning documents accurately. We only start trusting them with even the most basic of medications from like 12 to 16 years of age.

If something is fragile as well as dangerous, that limit is far too low. A 7 year old has just started learning to read. They will likely not be able to understand that warning flyer properly, let alone properly understand the implications.

eloy · August 6, 2025, 1:28am

The wiki page is now also available via http://WHY18650.org

wvholst · August 6, 2025, 6:13am

Community members may very well sue IFCAT if their house were to burn down due to the badge. Not just that, that decision may no longer be theirs but their insurance company to make. This is not something to YOLO. And IFCAT taking the position that this is a development kit is not likely to hold water* given the communication and hyped promotion of it in the run-up to the WHY2025 event. This is product recall territory.

not a product liability lawyer, but practicing law on ICT and product liability is extending into ICT now.

Burner · August 6, 2025, 7:41am

Log writing but most important question was without answers. What is real chemistry of those cells? There is HUGE difference on dangers depending of cell. If it is IMR or LFP then it is not more danger than previous years. If it is NCA then there is higher risk. Yest it wont matter to how PCB it self go up in flames but it really matter to will that cell it self burst to flames.

illyau · August 6, 2025, 7:48am

https://www.nkon.nl/en/inr18650-m29-2850mah-10a.html

wvholst · August 6, 2025, 8:52am

So they could have mitigated all of this with a protected 18650?

Juerd · August 6, 2025, 8:58am

Probably, but this should be verified and tested before anyone could state this with certainty.

According to sources, protected cells were discussed by the designers, and deemed too expensive. Other features got priority.

Unfortunately, commonly available protected 18650 cells don’t fit in the cell holders because the protection circuit adds a few extra mm to the length of the cell.

krekr · August 6, 2025, 10:34am

Hi all, I just joined this forum specifically for this topic. I’m printing spacers and through those channels was made aware of these issues.

When I first saw the design, I was both in awe of its complexity and assuming the 18650 that were going to be distributed would come with protection circuitry. Safety obviously wasn’t neglected - there are several safeguards already built in.

Remember: Anything that can go wrong, will eventually go wrong. Especially during an event, with thousands of products distributed in harsh mechanical conditions. These cells, even with protection, are able to provide multiple Amperes of current, some even in the double digits.

I can already hear the sysadmin “ha ha people are stupid”-type banter if something happens. This is not acceptable. Attendees are people and people should be able to trust that anything they buy or are given doesn’t pose a hazard to them or their belongings. This is called compliance.

From a legal perspective: Even if the badge is given away and isn’t CE-marked, it is a product that is circulated (“in het economisch verkeer brengen” is the Dutch legalese) and therefore should follow best practices for product safety.

This means: always plan for first-order failures and mitigate risks. The main issues that stand out with this design:

Main issues (I think) not otherwise reported:

(Unprotected) Battery positive nets should have net class-defined minimum track widths with significant safety margin (200-300%). I’m looking at you, “Net-(BT1-+)” & “Net-(BT2-+)”"
Fuses should be as close to the parts they are protecting as possible, mostly because of the point outlined above
Even with these protections, a protected cell can still output a lot of current. I haven’t done any calculations, but the specified polyfuses have a trip current of 3.5A. If you’re using protected cells, they will have similar protection levels. Even if Net-(BT2-+) was behind that polyfuse (or builtin protection), the thin 0,2mm traces running al the way to the bottom of the board would still burn out if say R43/R48 was (will be!) short circuited to the negative terminal about a milimeter away, positioned on the edge of the board. It will become an ideal glow-wire ready to start a fire.
A similar issues is present at U3: its ground terminal is right next to an unprotected exposed battery contact (F2), creating a possible glow wire out of the (arguably thicker “Net-(BT2-+)”-trace running horizontally)

Other issues already reported

Risk 1: Copper layer and solder mask:
- I fully concur, I have experienced this myself in a similar product with these holders.
The cell holder tabs
- while somewhat receded, from my preliminary review these form the biggest issue since they can carry a lot of current and cannot be mitigated with some epoxy
Exposed (uninsulated) solder joints (mitigated)
- The connections in the screenshots are from direct battery “+”-tabs to GND-planes, which is less dangerous than the issues I oulined above because there isn’t a long, thin trace involved.
- Even ‘potting’ these risks doesn’t provide a full mitigation. More so because this is not some ISO9001-operating manufacturing company, but a group of volunteers (doing their best!)

Mitigation

I’m proposing a minimally designed cover that covers the battery holders and adjacent electronics. I will work on this today and share the design. I know there already is a (beautifully designed) full enclosure by @dynom, but these take a lot more time to print.
This cover will function as an extra layer of protection on top of the epoxy.

Disclaimer

I’m not a lawyer and/or a trained electrical engineer. Also: This post is also not a ‘flame’ on the design or designers. I’m just trying to help. Thanks for making an awesome badge for this awesome event.

Juerd · August 6, 2025, 10:44am

Thanks for your additional thoughts.

Please take into consideration that plastics can burn; how much distance were you planning between what you called “glow wire” and the “minimally designed cover”?

pbx · August 6, 2025, 10:54am

As someone who was involved in the findings but did not have time to proof read, i want to correct the info on the cell holder tabs: The design has a pad size of 7.46 x 6.47 mm, whereas the datasheet specifies 7.77 x 7.35. Computing the worst allowed position of the tab edge by stacking the datasheet tolerances yields a required pad size of slightly less than this datasheet number but also yields a worst case overlap of .45mm onto the ground pad, leaving only soldermask insulate b+ from ground.

krekr · August 6, 2025, 11:26am

Good point. The main purpose of the cover would be to minimize the possibility of shorts actually occurring, but in the event they do anyway, it’s nice to have some margin.

Anyone in the The Hague area with (prototype) hardware available?
I would love to do some destructive testing. I might even make a mock up board specifically for this purpose.

Two other thoughts: the risks aren’t just contained to the event itself. The badges (hopefully) will have a long life after that. For instance, my MCH badge is still lying around the house being used as a game console.
This introduces new users and usage environments, obviously beyond the original scope of the “development board” but still good to consider.

Second: The reply from the organizers includes a statement saying badges will only be handed out to children ages seven and up. I have a technically inclined son of seven who I wouldn’t trust with this.
Depending on what I find in person, I might not even power them from the cells myself while it is in an enclosure.

I’m not naturally a cautious person. I don’t mind taking some risks, but I also wouldn’t want anything bad to happen.

I’m taking as many protected cells as I can and aforementioned covers and enclosures. I will also try to bring a spot welder and some kits to make cells protected, but 3500 pieces of hardware is a lot of ‘stuff’ floating around

pbx · August 6, 2025, 12:17pm

unfortunately normal procected cells are too long to fit in the badge

we did do some destructive testing and while we only had a 20A bench PSU to test with we were able to get several seconds of incandescence out of the reverse polarity protection mosfet by shorting B+ to GND deliberately.

the max current might change the behaviour a bit but we observed < 600 ms of full short circuit current followed by 1-2 s of lower currents with the PSU in CV mode, and this is when the mosfet turned into a cigarette lighter

pinoaffe · August 6, 2025, 12:48pm

@Juerd Thank you for writing this up, hopefully increased awareness can help prevent any incidents

(and thanks to everyone else involved in the discovery/mitigation)

Burner · August 6, 2025, 1:30pm

so these are NMC cells. Better than unprotected LiPo Cells. I dont say that these are completely safe but also those wont explode as fire cracker when shorted.